Is CVE-2026-40228 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40228 being exploited in the wild.

How severe is CVE-2026-40228?

Low severity, with a CVSS score of 2.9, published 10 April 2026.

Is there a fix for CVE-2026-40228?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-40228 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-40228?

Check whether you run Systemd Project Systemd. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40228: systemd systemd-journald ANSI escape sequence injection in wall messages

CVE-2026-40228 · Severity: low · CVSS 2.9 · Published 2026-04-10

A vulnerability in systemd-journald allows a local user to send malicious control codes to the terminal screens of other users, including administrators. This occurs because the system fails to clean up special characters in emergency log messages before broadcasting them to all active users. An attacker could use this to trick an administrator's terminal into executing unauthorized commands or stealing sensitive data if the administrator is using a vulnerable terminal application.

Technologies: Systemd Project Systemd. Vendors: Systemd Project.

Quick answers

Is CVE-2026-40228 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40228 being exploited in the wild.
How severe is CVE-2026-40228?: Low severity, with a CVSS score of 2.9, published 10 April 2026.
Which products and versions are affected?: systemd project systemd 259.
Is there a fix for CVE-2026-40228?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-40228 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-40228?: Check whether you run Systemd Project Systemd. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

systemd-journald in systemd 259 is vulnerable to an injection flaw when 'ForwardToWall=yes' is enabled (often the default). The component fails to sanitize ANSI escape sequences from log messages before broadcasting them via the 'wall' mechanism. A local, unprivileged attacker can use the 'logger -p emerg' command to send crafted messages containing terminal escape sequences. If an administrator or another user is using a terminal emulator vulnerable to escape sequence injection (such as certain versions of XTerm), the attacker can achieve arbitrary code execution or unauthorized file access in the context of that user. Mitigation involves setting 'ForwardToWall=no' in journald.conf.

Affected products

systemd project systemd 259

Timeline

2025-12-23: disclosed: Privately reported to upstream developers
2026-04-07: advisory: Public disclosure by researcher
2026-04-10: other: CVE assigned

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.